GitHub
CompanyFacts
- Country
- United StatesSource: Wikidata
- Founded
- 2007Source: Wikidata
- Official website
- github.comSource: Wikidata
Security timeline
- Advisory or policy news by CSO OnlineConfig files for AI coding assistants can run commands on developer machines, so reviews must check them
- Advisory or policy news by The Register (all)Amazon memo on AI use in engineering draws scepticism over mixed messages and token-usage metrics
- Malware reported by Security AffairsYoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
- Vulnerability reported by Help Net SecurityEmbedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Recent news
Config files for AI coding assistants can run commands on developer machines, so reviews must check them
The article argues that merging a configuration change for an AI coding assistant can distribute execution instructions to everyone working in the repository. It cites StepSecurity's October 8 analysis of the June Miasma campaign, which planted AI-tool and editor configuration in a Microsoft repository to harvest credentials, and recommends named owners, enforced review through branch protection, and checks on user-level and shared skills and plugins.
Amazon memo on AI use in engineering draws scepticism over mixed messages and token-usage metrics
An Amazon memo by a Distinguished Engineer says engineers who find AI does not help their work should document it as a finding, not a failing. The columnist argues the memo contradicts itself on input metrics and warns that token-usage targets, like Amazon's shut-down KiroRank leaderboard, can be gamed, while AWS earns revenue from token billing.
Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
Check Point Research tracks a campaign called Yoba that uses fake GitHub projects posing as OpenAI and Anthropic desktop apps, delivered via SEO poisoning. Each ZIP pairs a signed Setup.exe with a malicious winmm.dll for DLL sideloading, which installs a multi-stage loader that fetches payloads via Telegram, DNS-over-HTTPS and Catbox, and ends with an XMRig miner routed through Tor.
Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.
Fake GitHub repo tricks AI agents into installing SolanaCry malware
A fake GitHub repository deceives AI coding agents into installing SolanaCry malware. The malware uses NetSupport to give attackers remote access to developers' Windows PCs.